selma 0.2.2 → 0.4.10

data/ext/selma/src/sanitizer.rs

@@ -5,9 +5,11 @@ use lol_html::{
     html_content::{Comment, ContentType, Doctype, Element, EndTag},
 };
 use magnus::{
-    class, function, method, scan_args,
+    class, eval, exception, function, method,
+    r_hash::ForEach,
+    scan_args,
     value::{Opaque, ReprValue},
-    Module, Object, RArray, RHash, RModule, Ruby, Value,
+    Module, Object, RArray, RHash, RModule, RString, Ruby, Symbol, Value,
 };
 
 #[derive(Clone, Debug, Default)]
@@ -45,34 +47,234 @@ impl SelmaSanitizer {
         let args = scan_args::scan_args::<(), (Option<RHash>,), (), (), (), ()>(arguments)?;
         let (opt_config,): (Option<RHash>,) = args.optional;
 
+        let ruby = Ruby::get().unwrap();
+
         let config = match opt_config {
             Some(config) => config,
             // TODO: this seems like a hack to fix?
             None => magnus::eval::<RHash>(r#"Selma::Sanitizer::Config::DEFAULT"#).unwrap(),
         };
 
+        let mut flags = [0; crate::tags::Tag::TAG_COUNT];
+        let mut sanitizer_allowed_attrs = vec![];
+        let sanitizer_allowed_classes = vec![];
+        match Self::setup_config(&mut flags, config) {
+            Ok(_) => {}
+            Err(e) => {
+                return Err(e);
+            }
+        };
+
         let mut element_sanitizers = HashMap::new();
+
+        // TODO: set up default tags; do we need this?
         crate::tags::Tag::html_tags().iter().for_each(|html_tag| {
-            let es = ElementSanitizer::default();
-            element_sanitizers.insert(
-                crate::tags::Tag::element_name_from_enum(html_tag).to_string(),
-                es,
-            );
+            let element_name = crate::tags::Tag::element_name_from_enum(html_tag).to_string();
+
+            let element_sanitizer = ElementSanitizer::default();
+            element_sanitizers.insert(element_name, element_sanitizer);
         });
 
+        // def allow_attribute(element, attrs)
+        //   attrs.flatten.each { |attr| set_allowed_attribute(element, attr, true) }
+        // end
+        if let Some(value) = config.get(ruby.to_symbol("attributes")) {
+            if let Some(allowed_attributes) = RHash::from_value(value) {
+                allowed_attributes.foreach(|element_value: Value, attributes: RArray| {
+                    attributes.into_iter().for_each(|attr: Value| {
+                        match RString::from_value(attr) {
+                            None => {}
+                            Some(attribute_name) => {
+                                let attr_name = attribute_name.to_string().unwrap();
+                                let element = match element_value.to_r_string() {
+                                    Err(_) => "".to_string(),
+                                    Ok(element_name) => element_name.to_string().unwrap(),
+                                };
+                                if element == "all" {
+                                    Self::set_allowed(
+                                        &mut sanitizer_allowed_attrs,
+                                        &attr_name,
+                                        true,
+                                    );
+                                } else {
+                                    let element_sanitizer = Self::get_element_sanitizer(
+                                        &mut element_sanitizers,
+                                        &element,
+                                    );
+                                    element_sanitizer.allowed_attrs.push(attr_name);
+                                }
+                            }
+                        }
+                    });
+
+                    Ok(ForEach::Continue)
+                })?;
+            }
+        };
+
+        // def allow_protocol(element, attr, protos)
+        //  if protos.is_a?(Array)
+        //    raise ArgumentError, "`:all` must be passed outside of an array" if protos.include?(:all)
+        //  else
+        //    protos = [protos]
+        //  end
+        //  set_allowed_protocols(element, attr, protos)
+        // end
+        if let Some(value) = config.get(ruby.to_symbol("protocols")) {
+            if let Some(allowed_protocols) = RHash::from_value(value) {
+                allowed_protocols.foreach(|element_name: String, protocols: RHash| {
+                    protocols.foreach(|attribute_name: String, protocol_list: Value| {
+                        let protocols: RArray;
+                        if protocol_list.is_kind_of(class::array()) {
+                            protocols = RArray::from_value(protocol_list).unwrap();
+                            if protocols.includes(ruby.to_symbol("all")) {
+                                return Err(magnus::Error::new(
+                                    exception::arg_error(),
+                                    "`:all` must be passed outside of an array".to_string(),
+                                ));
+                            }
+                        } else if protocol_list.is_kind_of(class::symbol())
+                            && Symbol::from_value(protocol_list) == eval(":all").unwrap()
+                        {
+                            protocols = RArray::new();
+                            protocols.push(ruby.to_symbol("all"))?;
+                        } else {
+                            return Err(magnus::Error::new(
+                                exception::arg_error(),
+                                "Protocol list must be an array, or just `:all`".to_string(),
+                            ));
+                        }
+
+                        let element_sanitizer =
+                            Self::get_element_sanitizer(&mut element_sanitizers, &element_name);
+
+                        Self::set_allowed_protocols(element_sanitizer, attribute_name, protocols);
+                        Ok(ForEach::Continue)
+                    })?;
+
+                    Ok(ForEach::Continue)
+                })?;
+            }
+        }
+
+        let escape_tagfilter = match config.get(ruby.to_symbol("escape_tagfilter")) {
+            Some(value) => value.to_bool(),
+            None => true,
+        };
+
+        let allow_comments = match config.get(ruby.to_symbol("allow_comments")) {
+            Some(value) => value.to_bool(),
+            None => false,
+        };
+
+        let allow_doctype = match config.get(ruby.to_symbol("allow_doctype")) {
+            Some(value) => value.to_bool(),
+            None => true,
+        };
+
         Ok(Self(std::cell::RefCell::new(Sanitizer {
-            flags: [0; crate::tags::Tag::TAG_COUNT],
-            allowed_attrs: vec![],
-            allowed_classes: vec![],
+            flags,
+            allowed_attrs: sanitizer_allowed_attrs,
+            allowed_classes: sanitizer_allowed_classes,
             element_sanitizers,
 
-            escape_tagfilter: true,
-            allow_comments: false,
-            allow_doctype: true,
+            escape_tagfilter,
+            allow_comments,
+            allow_doctype,
             config: config.into(),
         })))
     }
 
+    fn setup_config(
+        flags: &mut [u8; crate::tags::Tag::TAG_COUNT],
+        config: RHash,
+    ) -> Result<(), magnus::Error> {
+        let ruby = Ruby::get().unwrap();
+
+        // def allow_element(elements)
+        //   elements.flatten.each { |e| set_flag(e, ALLOW, true) }
+        // end
+        if let Some(value) = config.get(ruby.to_symbol("elements")) {
+            if let Some(elements) = RArray::from_value(value) {
+                elements
+                    .into_iter()
+                    .for_each(|element| match RString::from_value(element) {
+                        None => {}
+                        Some(element_name) => {
+                            Self::set_flag(
+                                element_name.to_string().unwrap(),
+                                flags,
+                                Self::SELMA_SANITIZER_ALLOW,
+                                true,
+                            );
+                        }
+                    });
+            }
+        }
+
+        // def remove_contents(elements)
+        //  if elements.is_a?(TrueClass) || elements.is_a?(FalseClass)
+        //    set_all_flags(REMOVE_CONTENTS, elements)
+        //  else
+        //    elements.flatten.each { |e| set_flag(e, REMOVE_CONTENTS, true) }
+        //  end
+        // end
+        if let Some(remove_contents) = config.get(ruby.to_symbol("remove_contents")) {
+            if remove_contents.is_kind_of(class::true_class())
+                || remove_contents.is_kind_of(class::false_class())
+            {
+                Self::set_all_flags(
+                    flags,
+                    Self::SELMA_SANITIZER_REMOVE_CONTENTS,
+                    remove_contents.to_bool(),
+                );
+            } else if remove_contents.is_kind_of(class::array()) {
+                let elements = RArray::from_value(remove_contents).unwrap();
+                elements
+                    .into_iter()
+                    .for_each(|element| match RString::from_value(element) {
+                        None => {}
+                        Some(element_name) => {
+                            Self::set_flag(
+                                element_name.to_string().unwrap(),
+                                flags,
+                                Self::SELMA_SANITIZER_REMOVE_CONTENTS,
+                                true,
+                            );
+                        }
+                    });
+            } else {
+                return Err(magnus::Error::new(
+                    exception::arg_error(),
+                    "remove_contents must be `true`, `false`, or an array".to_string(),
+                ));
+            }
+        }
+
+        // def wrap_with_whitespace(elements)
+        //  elements.flatten.each { |e| set_flag(e, WRAP_WHITESPACE, true) }
+        // end
+        if let Some(value) = config.get(ruby.to_symbol("whitespace_elements")) {
+            if let Some(elements) = RArray::from_value(value) {
+                elements
+                    .into_iter()
+                    .for_each(|element| match RString::from_value(element) {
+                        None => {}
+                        Some(element_name) => {
+                            Self::set_flag(
+                                element_name.to_string().unwrap(),
+                                flags,
+                                Self::SELMA_SANITIZER_WRAP_WHITESPACE,
+                                true,
+                            );
+                        }
+                    });
+            }
+        };
+
+        Ok(())
+    }
+
     fn get_config(&self) -> Result<RHash, magnus::Error> {
         let binding = self.0.borrow();
         let ruby = Ruby::get().unwrap();
@@ -81,40 +283,39 @@ impl SelmaSanitizer {
     }
 
     /// Toggle a sanitizer option on or off.
-    fn set_flag(&self, tag_name: String, flag: u8, set: bool) {
+    fn set_flag(
+        tag_name: String,
+        flags: &mut [u8; crate::tags::Tag::TAG_COUNT],
+        flag: u8,
+        set: bool,
+    ) {
         let tag = crate::tags::Tag::tag_from_tag_name(tag_name.as_str());
         if set {
-            self.0.borrow_mut().flags[tag.index] |= flag;
+            flags[tag.index] |= flag;
         } else {
-            self.0.borrow_mut().flags[tag.index] &= !flag;
+            flags[tag.index] &= !flag;
         }
     }
 
     /// Toggles all sanitization options on or off.
-    fn set_all_flags(&self, flag: u8, set: bool) {
+    fn set_all_flags(flags: &mut [u8; crate::tags::Tag::TAG_COUNT], flag: u8, set: bool) {
         if set {
             crate::tags::Tag::html_tags()
                 .iter()
                 .enumerate()
                 .for_each(|(iter, _)| {
-                    self.0.borrow_mut().flags[iter] |= flag;
+                    flags[iter] |= flag;
                 });
         } else {
             crate::tags::Tag::html_tags()
                 .iter()
                 .enumerate()
                 .for_each(|(iter, _)| {
-                    self.0.borrow_mut().flags[iter] &= flag;
+                    flags[iter] &= flag;
                 });
         }
     }
 
-    /// Whether or not to keep dangerous HTML tags.
-    fn set_escape_tagfilter(&self, allow: bool) -> bool {
-        self.0.borrow_mut().escape_tagfilter = allow;
-        allow
-    }
-
     pub fn escape_tagfilter(&self, e: &mut Element) -> bool {
         if self.0.borrow().escape_tagfilter {
             let tag = crate::tags::Tag::tag_from_element(e);
@@ -131,12 +332,6 @@ impl SelmaSanitizer {
         self.0.borrow().escape_tagfilter
     }
 
-    /// Whether or not to keep HTML comments.
-    fn set_allow_comments(&self, allow: bool) -> bool {
-        self.0.borrow_mut().allow_comments = allow;
-        allow
-    }
-
     pub fn get_allow_comments(&self) -> bool {
         self.0.borrow().allow_comments
     }
@@ -145,12 +340,6 @@ impl SelmaSanitizer {
         c.remove();
     }
 
-    /// Whether or not to keep HTML doctype.
-    fn set_allow_doctype(&self, allow: bool) -> bool {
-        self.0.borrow_mut().allow_doctype = allow;
-        allow
-    }
-
     /// Whether or not to keep HTML doctype.
     pub fn get_allow_doctype(&self) -> bool {
         self.0.borrow().allow_doctype
@@ -160,48 +349,14 @@ impl SelmaSanitizer {
         d.remove();
     }
 
-    fn set_allowed_attribute(&self, eln: Value, attr_name: String, allow: bool) -> bool {
-        let mut binding = self.0.borrow_mut();
-
-        let element_name = eln.to_r_string().unwrap().to_string().unwrap();
-        if element_name == "all" {
-            let allowed_attrs = &mut binding.allowed_attrs;
-            Self::set_allowed(allowed_attrs, &attr_name, allow);
-        } else {
-            let element_sanitizers = &mut binding.element_sanitizers;
-            let element_sanitizer = Self::get_element_sanitizer(element_sanitizers, &element_name);
-
-            element_sanitizer.allowed_attrs.push(attr_name);
-        }
-
-        allow
-    }
-
-    fn set_allowed_class(&self, element_name: String, class_name: String, allow: bool) -> bool {
-        let mut binding = self.0.borrow_mut();
-        if element_name == "all" {
-            let allowed_classes = &mut binding.allowed_classes;
-            Self::set_allowed(allowed_classes, &class_name, allow);
-        } else {
-            let element_sanitizers = &mut binding.element_sanitizers;
-            let element_sanitizer = Self::get_element_sanitizer(element_sanitizers, &element_name);
-
-            let allowed_classes = element_sanitizer.allowed_classes.borrow_mut();
-            Self::set_allowed(allowed_classes, &class_name, allow)
-        }
-        allow
-    }
-
-    fn set_allowed_protocols(&self, element_name: String, attr_name: String, allow_list: RArray) {
-        let mut binding = self.0.borrow_mut();
-
-        let element_sanitizers = &mut binding.element_sanitizers;
-        let element_sanitizer = Self::get_element_sanitizer(element_sanitizers, &element_name);
-
+    fn set_allowed_protocols(
+        element_sanitizer: &mut ElementSanitizer,
+        attr_name: String,
+        allow_list: RArray,
+    ) {
         let protocol_sanitizers = &mut element_sanitizer.protocol_sanitizers.borrow_mut();
 
-        for opt_allowed_protocol in allow_list.each() {
-            let allowed_protocol = opt_allowed_protocol.unwrap();
+        for allowed_protocol in allow_list.into_iter() {
             let protocol_list = protocol_sanitizers.get_mut(&attr_name);
             if allowed_protocol.is_kind_of(class::string()) {
                 match protocol_list {
@@ -211,20 +366,23 @@ impl SelmaSanitizer {
                     }
                     Some(protocol_list) => protocol_list.push(allowed_protocol.to_string()),
                 }
-            } else if allowed_protocol.is_kind_of(class::symbol())
-                && allowed_protocol.inspect() == ":relative"
-            {
-                match protocol_list {
-                    None => {
-                        protocol_sanitizers.insert(
-                            attr_name.to_string(),
-                            vec!["#".to_string(), "/".to_string()],
-                        );
-                    }
-                    Some(protocol_list) => {
-                        protocol_list.push("#".to_string());
-                        protocol_list.push("/".to_string());
+            } else if allowed_protocol.is_kind_of(class::symbol()) {
+                let protocol_config = allowed_protocol.inspect();
+                if protocol_config == ":relative" {
+                    match protocol_list {
+                        None => {
+                            protocol_sanitizers.insert(
+                                attr_name.to_string(),
+                                vec!["#".to_string(), "/".to_string()],
+                            );
+                        }
+                        Some(protocol_list) => {
+                            protocol_list.push("#".to_string());
+                            protocol_list.push("/".to_string());
+                        }
                     }
+                } else if protocol_config == ":all" {
+                    protocol_sanitizers.insert(attr_name.to_string(), vec!["all".to_string()]);
                 }
             }
         }
@@ -335,7 +493,7 @@ impl SelmaSanitizer {
         element: &mut Element,
         element_sanitizer: &ElementSanitizer,
         attr_name: &String,
-        attr_val: &String,
+        attr_val: &str,
     ) -> Result<bool, AttributeNameError> {
         let mut allowed: bool = false;
         let element_allowed_attrs = element_sanitizer.allowed_attrs.contains(attr_name);
@@ -387,7 +545,11 @@ impl SelmaSanitizer {
         attr_val.contains("://")
     }
 
-    fn has_allowed_protocol(protocols_allowed: &[String], attr_val: &String) -> bool {
+    fn has_allowed_protocol(protocols_allowed: &[String], attr_val: &str) -> bool {
+        if protocols_allowed.contains(&"all".to_string()) {
+            return true;
+        }
+
         // FIXME: is there a more idiomatic way to do this?
         let mut pos: usize = 0;
         let mut chars = attr_val.chars();
@@ -509,6 +671,7 @@ impl SelmaSanitizer {
                     element.after(" ", ContentType::Text);
                 }
             }
+
             element.remove_and_keep_content();
         }
     }
@@ -542,7 +705,7 @@ impl SelmaSanitizer {
     ) -> &'a mut ElementSanitizer {
         element_sanitizers
             .entry(element_name.to_string())
-            .or_insert_with(ElementSanitizer::default)
+            .or_default()
     }
 }
 
@@ -554,50 +717,5 @@ pub fn init(m_selma: RModule) -> Result<(), magnus::Error> {
     c_sanitizer.define_singleton_method("new", function!(SelmaSanitizer::new, -1))?;
     c_sanitizer.define_method("config", method!(SelmaSanitizer::get_config, 0))?;
 
-    c_sanitizer.define_method("set_flag", method!(SelmaSanitizer::set_flag, 3))?;
-    c_sanitizer.define_method("set_all_flags", method!(SelmaSanitizer::set_all_flags, 2))?;
-
-    c_sanitizer.define_method(
-        "set_escape_tagfilter",
-        method!(SelmaSanitizer::set_escape_tagfilter, 1),
-    )?;
-    c_sanitizer.define_method(
-        "escape_tagfilter",
-        method!(SelmaSanitizer::get_escape_tagfilter, 0),
-    )?;
-
-    c_sanitizer.define_method(
-        "set_allow_comments",
-        method!(SelmaSanitizer::set_allow_comments, 1),
-    )?;
-    c_sanitizer.define_method(
-        "allow_comments",
-        method!(SelmaSanitizer::get_allow_comments, 0),
-    )?;
-
-    c_sanitizer.define_method(
-        "set_allow_doctype",
-        method!(SelmaSanitizer::set_allow_doctype, 1),
-    )?;
-    c_sanitizer.define_method(
-        "allow_doctype",
-        method!(SelmaSanitizer::get_allow_doctype, 0),
-    )?;
-
-    c_sanitizer.define_method(
-        "set_allowed_attribute",
-        method!(SelmaSanitizer::set_allowed_attribute, 3),
-    )?;
-
-    c_sanitizer.define_method(
-        "set_allowed_class",
-        method!(SelmaSanitizer::set_allowed_class, 3),
-    )?;
-
-    c_sanitizer.define_method(
-        "set_allowed_protocols",
-        method!(SelmaSanitizer::set_allowed_protocols, 3),
-    )?;
-
     Ok(())
 }

data/lib/selma/config.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+module Selma
+  module Config
+    OPTIONS = {
+      memory: {
+        max_allowed_memory_usage: nil,
+        preallocated_parsing_buffer_size: nil,
+      },
+    }
+  end
+end

data/lib/selma/html/element.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module Selma
+  class HTML
+    class Element
+      def available?
+        !removed?
+      end
+    end
+  end
+end

data/lib/selma/html.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative "html/element"
+
 module Selma
   class HTML
   end

data/lib/selma/sanitizer/config/default.rb

@@ -28,7 +28,7 @@ module Selma
 
         # URL handling protocols to allow in specific attributes. By default, no
         # protocols are allowed. Use :relative in place of a protocol if you want
-        # to allow relative URLs sans protocol.
+        # to allow relative URLs sans protocol. Set to `:all` to allow any protocol.
         protocols: {},
 
         # An Array of element names whose contents will be removed. The contents

data/lib/selma/sanitizer/config/relaxed.rb

@@ -16,6 +16,7 @@ module Selma
           "colgroup",
           "data",
           "del",
+          "details",
           "div",
           "figcaption",
           "figure",

data/lib/selma/sanitizer/config.rb

@@ -28,7 +28,7 @@ module Selma
           raise ArgumentError, "other_config must be a Hash" unless other_config.is_a?(Hash)
 
           merged = {}
-          keys   = Set.new(config.keys + other_config.keys)
+          keys   = Set.new(config.keys + other_config.keys).to_a
 
           keys.each do |key|
             oldval = config[key]
@@ -39,7 +39,7 @@ module Selma
               merged[key] = if oldval.is_a?(Hash) && newval.is_a?(Hash)
                 oldval.empty? ? newval.dup : merge(oldval, newval)
               elsif newval.is_a?(Array) && key != :transformers
-                Set.new(newval)
+                Set.new(newval).to_a
               else
                 can_dupe?(newval) ? newval.dup : newval
               end

data/lib/selma/sanitizer.rb

@@ -4,82 +4,5 @@ require "selma/sanitizer/config"
 
 module Selma
   class Sanitizer
-    ALLOW = 1 << 0
-    ESCAPE_TAGFILTER = (1 << 1)
-    REMOVE_CONTENTS = (1 << 2)
-    WRAP_WHITESPACE = (1 << 3)
-
-    # initialize is in Rust, this just helps manage config setup in Ruby
-    # TODO: could this just become initialize?
-    def setup
-      allow_element(config[:elements] || [])
-
-      (config[:attributes] || {}).each do |element, attrs|
-        allow_attribute(element, attrs)
-      end
-
-      (config[:protocols] || {}).each do |element, protocols|
-        protocols.each do |attribute, pr|
-          allow_protocol(element, attribute, pr)
-        end
-      end
-
-      remove_contents(config[:remove_contents]) if config.include?(:remove_contents)
-
-      wrap_with_whitespace(config[:whitespace_elements]) if config.include?(:whitespace_elements)
-
-      set_escape_tagfilter(config.fetch(:escape_tagfilter, true))
-      set_allow_comments(config.fetch(:allow_comments, false))
-      set_allow_doctype(config.fetch(:allow_doctype, true))
-    end
-
-    def elements
-      config[:elements]
-    end
-
-    def allow_element(elements)
-      elements.flatten.each { |e| set_flag(e, ALLOW, true) }
-    end
-
-    def disallow_element(elements)
-      elements.flatten.each { |e| set_flag(e, ALLOW, false) }
-    end
-
-    def allow_attribute(element, attrs)
-      attrs.flatten.each { |attr| set_allowed_attribute(element, attr, true) }
-    end
-
-    def require_any_attributes(element, attrs)
-      if attr.empty?
-        set_required_attribute(element, "*", true)
-      else
-        attrs.flatten.each { |attr| set_required_attribute(element, attr, true) }
-      end
-    end
-
-    def disallow_attribute(element, attrs)
-      attrs.flatten.each { |attr| set_allowed_attribute(element, attr, false) }
-    end
-
-    def allow_class(element, *klass)
-      klass.flatten.each { |k| set_allowed_class(element, k, true) }
-    end
-
-    def allow_protocol(element, attr, protos)
-      protos = [protos] unless protos.is_a?(Array)
-      set_allowed_protocols(element, attr, protos)
-    end
-
-    def remove_contents(elements)
-      if elements.is_a?(TrueClass) || elements.is_a?(FalseClass)
-        set_all_flags(REMOVE_CONTENTS, elements)
-      else
-        elements.flatten.each { |e| set_flag(e, REMOVE_CONTENTS, true) }
-      end
-    end
-
-    def wrap_with_whitespace(elements)
-      elements.flatten.each { |e| set_flag(e, WRAP_WHITESPACE, true) }
-    end
   end
 end

data/lib/selma/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Selma
-  VERSION = "0.2.2"
+  VERSION = "0.4.10"
 end